fix(durable): reclaim crash-orphaned running executions via staleness sweep

[bug-ops]

Summary

• Adds Journal::sweep_orphans, a crash-orphan staleness sweep folded into the existing supervised durable-retention tick (no new spawn site), running before the TTL prune. A status='running' row whose updated_at exceeds the new [durable.retention] stale_running_after_secs (default 3600s, 0 disables) becomes a candidate; it is hard-aborted only after a non-blocking try-acquire of its INV-15 advisory ExecutionLock succeeds — a live owner short-circuits to a skip, since staleness of updated_at alone never proves the owner is dead.
• Converts zeph-orchestration's journal_budget and zeph-scheduler's fire_with_durable to open_execution_exclusive, so their DagRun/ScheduledJob rows are observable to the sweep's liveness check; ExecutionLocked degrades to a graceful Ok(()) skip in both adapters, never a task failure.
• Extends open_execution's reopen path to un-finalize aborted rows too (previously only completed/failed), since the sweep makes aborted the common outcome of a resumable crash.
• zeph durable prune now runs the sweep before the TTL prune; --dry-run reports both counts separately. Postgres/:memory:/non-Unix backends (no advisory-lock dir) are a documented no-op with a warn-once log — never a staleness-only abort, which would reintroduce false-aborts of live executions.
• Spec updated first (specs/064-durable-execution/spec.md, INV-16/INV-17 + Crash-Orphan Sweep subsection) via architect → critic (2 rounds) → sdd → reviewer, then implementation followed the committed spec.

Closes #6254

Process notes

• Design went through 2 rounds of architect/critic iteration before the spec was written: round 1 found a critical flaw (the flock liveness signal only covered AgentTurn executions, would have caused deterministic false-aborts of long-running DagRun/ScheduledJob executions); round 2 approved the fix (converting those two call sites to open_execution_exclusive).
• Implementation went through a critical fix cycle: impl-critic found sweep_orphans_in_batches could hang indefinitely when the count of live-but-stale (lock-held) executions reached prune_batch_size, because the batch query had no keyset cursor and re-selected the same locked rows forever. Fixed via keyset pagination on (updated_at, execution_id); re-reviewed and approved.

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (13751 passed)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• RUSTFLAGS="-D warnings" cargo check --workspace --all-targets --features desktop,ide,server,chat,pdf,scheduler --locked
• cargo test --doc --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• cargo check -p zeph-durable --no-default-features --features postgres (compile-correctness for the no-op Postgres path)
• gitleaks protect --staged --no-banner --redact
• Real-DB/real-flock regression tests: sweep termination under all-lock-held candidates exceeding batch size, batch-boundary straddling, concurrent sweep-vs-reopen race, ExecutionLocked → Ok(()) for both adapters, INV-16 reopen-unifies-aborted
• CLI subprocess integration tests for durable prune/durable prune --dry-run
• Testing playbook (.local/testing/playbooks/durable.md) and coverage-status.md updated with 3 new scenarios (main-repo path, not tracked in this diff)
• Live kill -9 mid-turn session test — not run in this environment (documented as a coverage gap, not silently skipped); real-DB/real-flock unit tests cover the same mechanism at the function level